The vulnerability is an unauthenticated SQL Injection flaw present in Booknetic plugin version 4.8.5 and earlier on WordPress sites. An attacker can insert arbitrary SQL code through input fields that are not properly sanitized, enabling extraction of sensitive data, modification of database entries, or potentially full database compromise. The weakness is classified as CWE‑89.

Any WordPress site that has installed the Booknetic plugin with a version equal to or older than 4.8.5 is affected. Site administrators must verify their installed plugin version and upgrade accordingly.

The high CVSS score of 9.3 reflects a severe risk; the vulnerability does not require authentication and can be triggered through standard HTTP requests to the plugin. The EPSS score of 0.00383 indicates an exceptionally low probability of exploitation in the wild, but the lack of authentication barriers and the ability to directly inject SQL statements still present a high potential impact if exploited. The vulnerability is not currently listed in CISA’s KEV catalog.